Skip to main content

ws (Node.js WebSocket) CVE-2026-48779

HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-06-15 https://github.com/websockets/ws GHSA-96hv-2xvq-fx4p
Denial Of Service
7.5
CVSS 3.1 · Vendor: https://github.com/websockets/ws
Share

Severity by source

Vendor (https://github.com/websockets/ws) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Remote, unauthenticated peer over a standard WebSocket connection with no user interaction; impact is availability-only (process OOM), no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (https://github.com/websockets/ws).

CVSS VectorVendor: https://github.com/websockets/ws

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Source Code Evidence Fetched
Jun 15, 2026 - 17:15 vuln.today
Analysis Generated
Jun 15, 2026 - 17:15 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 320 npm packages depend on ws (27 direct, 295 indirect)

Ecosystem-wide dependent count for version 1.1.0.

DescriptionCVE.org

Impact

A high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM.

Proof of concept

js
import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 0 }, function () {
  const data = Buffer.alloc(1);
  const options = { fin: false };
  const { port } = wss.address();
  const ws = new WebSocket(`ws://localhost:${port}`);

  ws.on('open', function () {
    (function send() {
      ws.send(data, options, function (err) {
        if (err) return;
        send();
      });
    })();
  });

  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`client close - code: ${code} reason: ${reason.toString()}`);
  });
});

wss.on('connection', function (ws) {
  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`server close - code: ${code} reason: ${reason.toString()}`);
  });
});

Patches

The vulnerability was fixed in ws@8.21.0 (https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94) and backported to ws@7.5.11 (https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8), ws@6.2.4 (https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7), and ws@5.2.5 (https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53).

Workarounds

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

Credits

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

AnalysisAI

Memory exhaustion denial of service in the npm 'ws' WebSocket library allows a remote unauthenticated peer to crash a Node.js process by streaming many tiny WebSocket fragments that force the receiver to allocate structural wrappers far exceeding the documented maxPayload limit, ultimately triggering an out-of-memory termination. The flaw affects ws versions prior to 5.2.5, 6.2.4, 7.5.11, and 8.21.0, and publicly available exploit code exists in the GitHub Security Advisory GHSA-96hv-2xvq-fx4p.

Technical ContextAI

The 'ws' package is one of the most widely deployed pure-JavaScript WebSocket client and server implementations on Node.js, used directly and transitively by countless web frameworks (Socket.IO, Next.js dev server, Playwright, Webpack DevServer, etc.). The CPE strings (pkg:npm/ws) confirm the npm distribution is affected across major branches 5.x, 6.x, 7.x, and 8.x. The root cause is CWE-400 (Uncontrolled Resource Consumption): when a peer sends a flood of unfinished frames (fin:false) carrying very small payloads, the receiver creates a structural wrapper object per fragment whose bookkeeping overhead is several orders of magnitude larger than the byte payload itself. Because the existing maxPayload guard accounts for declared message bytes rather than the JavaScript object graph holding fragment metadata, an attacker can stay well under the documented byte limit while pushing the V8 heap toward OOM.

RemediationAI

Vendor-released patch: upgrade to ws 8.21.0 on the 8.x line, or apply the backports ws 7.5.11, 6.2.4, or 5.2.5 depending on the branch in use (commits bca91ad, fd36cd8, 86d3e8a, and b5372ac respectively, all referenced from https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p). After upgrading the direct dependency, run npm ls ws or equivalent to identify transitive copies pulled in by frameworks and either bump the parent package or use npm overrides / yarn resolutions to force the fixed version. If patching cannot be done immediately, the vendor-documented workaround is to lower the maxPayload option on the WebSocketServer / WebSocket constructor - the side effect is that legitimate clients sending larger messages will be disconnected, so the value should be set just above your application's real maximum frame size. Additional compensating controls include placing the WebSocket endpoint behind a reverse proxy or load balancer that enforces per-connection frame-rate and idle-time limits, and constraining process memory via systemd MemoryMax / Kubernetes memory limits so an OOM affects only one replica.

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-48779 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy